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LI 



3.8.0/33.celsy;:3.80/278.:<:cls: 

:705/6^6;CGis::ii;i±Bx 



L2 



311 



1 and (private secure$2) 



iUS-PGPUB;: 

;ijSPy!^;:-i:Er 
Ero;:iP(D; 1 



:0R= 



US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT 



OR 



L3 



i 70: 



:;:2:ahd;(un5eeure$2::irisecure^^ 



US-PGPUB; 

iuspp;^:::^: 



OR 



ON- 



:200S/02/:l;7 14:43 



ON 



2005/02/17 14:44 



ON: 



:2005/02/17; 14:44:; 



;EPO;;ilPO;: 

DfeRWENli; 



30 



3 and (purchase transaction) 



US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT 



OR 



ON 



2005/02/17 14:45 



:L6 



0^ 



;:705/640:GelS;; 



US-PGPUB; 
USPAT; ^ : : ; 



OR 



ON 



:2005/02/17:;i4:56: 



DERWENT: 



L7 



8829 



((705/43) or (705/39) or (705/26) 
or (705/44) or (705/64) or 
(235/380)).CCL5. 



US-PGPUB; 
USPAT; 
EPO; JPO; 
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OR 
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2005/02/17 15:02 



m 



7 and (pfiyate seeure$2) : 



US-PGPUB; 

EPO;:JPO;;; 
iDERWEINTlt^ 



OR 



ON: 



:2005/02/:17; 15:02: 



L9 



LIO 



Lll 



: Li2 :^ 



Cc^^M "-13 



376 



8 and (unsecure$2 insecure$2) 



360 



9:anci;(f)urehase;transaetion;)F 



287 



10 and encrypt$3 



153: 



11 and:(eherypt$3 near2 key): 



145 



12 and card 



US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT 

US-PGPUB;- 
USPAT; X 
EPO;: JPO;:; 
iDERVVENt;. 

US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT 

US-PGPUB; 
USPAT; • 
€p6; JPO; 
DERWENT 

US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT 



OR 



OR 



0R= 



OR 



ON 



2005/02/17 15:02 



ON 



: 2005/02/17.15:02 



ON 



2005/02/17 15:02 



ON: 



2005/02/17; 15!04: 



ON 



2005/02/17 15:04 



Search History 2/17/05 3:05:16 PM Page 1 
C:\Workspaces\09667440.wsp 



SI 



5216 



((705/43) or (705/39) or (705/26) 
or (705/44) or (705/64)).CCLS. 



US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWEIMT 



OR 



OFF 



2005/02/17 15:01 



;S2: 



2934 



SI ;arid;(prjyate ;SKure$2);:i±^^ 



US-PGPUB; 

;USP/^i^;r:;i;;± 



OR 



ON: 



i2005/02/;l;7:::l;5:02-^ 



S3 



;S4: 
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US-PGPUB; 
USPAT; 
EPO; JPO; 
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OR 



:S3iandi(|burchasit^ 



;US-PGPUB; 

iEPO;iilpS;i 

iderwent;- 



iOR 



ON 



ON 



2005/02/17 15:02 



:2005/02/17>15:.02 



S5 



i 



'S6: 



216 



S4 and encrypt$3 



US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT 



OR 



1241 



:S5 land 



UStPGPUB; 

EPO;iJPO;:i 
DERWENli 



OR 



ON 



ON; 



2005/02/17 15:02 



:2005/02/l7;;i5:03 
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55 financial()(electronic()data()interchang? or edi) 
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57 RD 
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El 2 .OrrMg agrees to share its ATMs w^ith Phis. (Cirru s S ystem Inc.. Phi:^ yu'twork) - April - 
3^v^ 1989 - Gale Group Computer Database™ 

3 Jmxig^ systcB^s garn er NOAC spotlight. (American Baokivrs^ Association'^ NatioBal 
O perations and Automation Couference) - July - 1989 - Gale Group Computer Database™ 

^ 4 Inia^e processing: Its role beyond check proccsslng v - March 19 - 1990 - Gale Group Trade 
and Industry Database™ 

1*^1 5 North of the border, (electronic data interchange and electronic ftmds transfers in 
Canaxia) (EF'37E3>I: The Search for Certaiiitles) - July - 1990 - Gale Group Trade and 
Industry Database™ 

6 Safety In n unfbeY-s: r he f raads tv measures j 

lE QVED I : ,Tlxe Search ^ - July - 1990 - Gale Group Trade and Industry 

Database™ 
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7 Database aspects of Integrated circuit cards. - Wntr - 1991 - Gale Group Trade and Industry 
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121 8 Elecrromc transfer of government b enelKs. - April - 1991 - Gale Group Trade and Industry 
Database™ 

[3 9 I'he casl^-iree go^^ - Nov-Dec - 1992 - Gale Group Trade and 

Industry Database™ 

^ 10 Security issMcs in Ei^^ - Jan/Feb 1993 - Word Count: 1256 - ABI/INFORM® 

11 IRE ANNOUNCES NEW LOW COST PRODUCTS TO SECURE ELECTRONIC 
FUNDS 1:RANS:8^ERS - June 28 - 1993 - Gale Group Trade and Industry Database™ 

El 12 The electronic purse: Go-ahead from Iberian banks and La Poste - Nov 1993 - Word 
Count: 1 172 - ABI/INFORM® 

SJ 13 Using EDI to improve the accounts payable department - Jan 1994 - Word Count: 2279 - 
ABUINFORM® 

\yQ 14 Best prac tice^ in ire - Mar/Apr 1994 - Word Count: 1822 - 

ABI/INFORM® 

El 15 Smart car - March - 1994 - 

Gale Group Trade and Industry Database™ 

\^ 16 Beat the hackers - Apr 25, 1994 - Word Count: 872 - ABI/INFORM® 

Sii 17 Beyond paner - May/Jun 1994 - Word Count: 2350 - ABI/INFORM® 

v| 18 Brave new cvbcrworM - Sep 1994 - Word Count: 2077 - ABI/INFORM® 

B 19 DaubM-dur>^jM - Nov 1994 - Word Count: 2129 - ABI/INFORM® 

^ 20 IiijbrrnaMoM jiUfie^ - Nov 18 - 1994 - 

Gale Group Trade and Industry Database™ 
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55 financial()(electronic()data()interchang? or edi) 
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56 s4 and s5 

57 RD 

58 SORT /ALL/pd,a 

D 21 Netscape adds sec-«.n.tv feature to its WWW sen^'r - Nov 21, 1994 - Word Count: 367 - 
ABI/INFORM® 

i I 22 EFT Issui's: SecHf ity Brm t^s Yhix And Microsoft foto Ab UaMkely AIMa«ce - Dec 3 - 1994 
- Word Count: 585 - Gale Group PROMT® 

Cl 23 Latest Intejuet coxnaicrcc deal (Mosaic ConimuaicatloBS Coii). aiui First Data Corp. 
Electronic Funds Services contract enables banks> companies to use fatei'aet for funds 
transfer) (M'arket Watch) - Dec 5 - 1994 - Gale Group Trade and Industry Database™ 

G 24 W^ells taps Cybercash for secure Internet payments. (Wells Fargo and Company Inc.) 
(Inclodes related artide ou WeOs i>hm to test an .ir\t|£racfivc 

cable service for vtst by consiMners with personal coTuputers) - Dec 22 - 1994 - Gale Group 
Trade and Industry Database™ 

□ 25 Wells Fargo banks on I nternet use - Dec 26, 1994/Jan 2, 1995 - Word Count: 339 - 
ABI/INFORM® 

O 26 Iiulustry players in hot pursuit of secure Internet transaction mode - Jan 1995 - Word 
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□ 27 Banks to g^ive VISA, Microsoft a run for their money, (secure online payment system 

joint yen tu^^ - Jan 4 - 1 995 - Gale Group Trade and Industry Database™ 

O 28 Baiiikmg oil in^nltlined - Spring - 1995 - Gale Group Trade and Industry Database™ 

D 29 A player goes after big buck s inn cyberspace, (fmancial advisors Lee Stein founds First 
Vlftaai EoSdings iiic.) - May 5 - 1995 - Gale Group Trade and Industry Database™ 

G 30 A differe nt drummer on the data higlmay. (David Chanm and his electronic payment 
coiiiipany Dlgi^ - May 12 - 1995 - Gale Group Trade and 

Industry Database™ 

O 31 Iliie Imme ban^^^ - July - 1995 - Gale Group Trade and 

Industry Database™ 

□ 32 H ere com es E- eg s h. but Waslii^ii g ton is jr t r es dy - Jul 3, 1995 - Word Count: 504 - 

ABI/INFORM® 

CJ 33 Sf^rhi^.electro?^^ - Jul 10, 1995 - Word Count: 1049 - 

ABI/INFORM® 

O 34 j>oM^ b^l^gjgjS mjt th^ - August - 

1995 - Gale Group Trade and Industry Database™ 

CJ 35 Trgmactfoit.$ecMjt^ - August 2 - 1995 - Gale Group Trade and 

Industry Database™ 

36 Sm!:^j:o ff^^^^^ 

Enabling Natioinvide Frocesslivg Ni-twork. - Sep 21 - 1995 - Gale Group Trade and Industry 



LJ 37 CbecMree asks IPO investo rs to im derwrlte $50M offe ring. (Initlai public olTermg^) - Sep 
25 - 1995 - Gale Group Trade and Industry Database™ 

□ 38 Out of the box - Nov 1995 - Word Count: 1828 - ABI/INFORM® 

□ 39 Payments on the ^Net? How many? How safe? - Nov 1995 - Word Count: 3156 - 

ABI/INFORM® 

□ 40 Hardware veiidor otienug Internet payment security. (Atalla Corp.) - Nov 8 - 1995 - Gale 

Group Trade and Industry Database™ 
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□ 41 Befijilng the fclectronic fHture.(Tech Notes) - Dec - 1995 - Gale Group Trade and Industry 

Database™ 

O 42 yeriSjga hires expert m dlj^ital contmerce law as a \T.(Mkbaej S. Baarn) - Dec 5 - 1995 ■ 
Gale Group Trade and Industry Database™ 

□ 43 EU'ctromc. commerce at Bake Power - Jan/Feb 1996 - Word Count: 1761 - ABI/INFORM® 

□ 44 SMwdovyn over e-eash - Jan 1996 - Word Count: 4930 - ABI/INFORM® 

□ 45 Card firms ratify payment specs - Feb 1996 - Word Count: 830 - ABI/INFORM® 
O 46 Money for t he infonnation age - Feb 1996 - Word Count: 947 - ABI/INFORM® 

□ 47 Strategic moves - Feb 1996 - Word Count: 2702 - ABI/INFORM® 

L ] 48 Fighting over InterBet pavaieats. (coaipetitloo to s»pi>lv electromc payment systems) - 
Feb - 1996 - Gale Group Trade and Industry Database™ 

G 49 Protect your money from cyb ertheft - Feb - 1996 - Gale Group Trade and Industry 
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G 50 Warning about Internet pa^^ient security raises cries of Talse alarm. YFIrst Virtuai 

Ifoldhigs jyic. clamis ^SYuffer * prog rams can endanger oniine transactioa security^^ - Feb 1 - 
1996 - Gale Group Trade and Industry Database™ 

LJ 51 Demjlti^MCQ!^^^^^ work j^lu^M ,oj;^Jj,^CMn ai^d 

Vi^a a^reeBu^nt) - Feb 2 - 1 996 - Gale Group Trade and Industry Database™ 

G 52 Paynient s coBllda is key t o iMerner .saSes - Mar 1996 - Word Count: 1319 - 
AByiNFORM® 

D 53 /y:mvng jxrinna^ 

Banking: Trends m Electroatc Moi^ey arsd Faymeats) - March 18 - 1996 - Gale Group 
Trade and Industry Database™ 

□ 54 For EFT; the fatore is bow - Apr 1996 - Word Count: 1404 - ABI/INFORM® 

D 55 WIU Sinykljl card Ira^d oy^ the Mfem^^ 

protocol) - April - 1996 - Gale Group Trade and Industry Database™ 

G 56 Shoukl you t^el secure? (obJIbc transactions ob the Intern^- t)(T^^^ - April 18 - 

1996 - Gale Group Trade and Industry Database™ 

□ 57 Race on to come up with Web p^ymeut system. (World Wide Web: ekalrouic payivu^nt 

svstems)(Speciai Rep ort) - April 27 - 1996 - Gale Group Trade and Industry Database™ 

O 58 The Net takes its toll (elect ronic tra nsactions across the Inter«et) - May - 1996 - Gale 
Group Trade and Industry Database™ 

□ 59 Money In ekctroBic commerce: Digital cash, electronic fund tramfer, and Ecash - Jun 

1996 - Word Count: 4172 - ABI/INFORM® 

G 60 EkctroBlc checks - a detailed preview. - Summer - 1 996 - Gale Group Trade and Industry 
Database™ 
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61 ELECTRONIC FUND TRAJ^SFER SECURITY AND SPEED INCREASED 

WITH l<LAC AL SECURI FY MODULE - June 10 - 1996 - Gale Group Trade and Industry 
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L J 62 Key question for emeriimg systems: where is the money? (eiectromc money 

system$j(FiA^ - June 17 - 1996 - Gale Group Trade and Industry 

Database™ 

O 63 C'-horus olf' cheers 

conferen^^^^^^ - June 26 - 1996 - Gale Group Trade and Industry 

Database™ 

^ i 64 How thi^ cash Hows, (electronic payiiU'iU systems) (lnchid^s glossary of acronvmsXCover 
Stor>0 - August - 1996 - Gale Group Trade and Industry Database™ 

LI 65 ReinveBtIng the bank as Idea lactorv. (techu olo ^cal advances force chai^ges m 

banking indit§try)(FutiireBanking)(Column) - August 19 - 1996 - Gale Group Trade and 
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Sjijjaii curre^^^^ - Sep - 1996 - Gale Group Trade and Industry Database™ 

□ 67 As the tcchnolo secnnry debate stlii ragegy feleciToiH 

reiated article on i^n()ixvnv?ty a^^^^^^^^ of dedrn^^^^^ - Dec 23 - 1996 - Gale Group 

Trade and Industry Database™ 

□ 68 Beyoa^d credit cards - Jan 1997 - Word Count: 547 - ABI/INFORM® 

□ 69 Secure pec tro^^^^ - Jan 31 - 1997 - Gale Group 

Trade and Industry Database™ 

□ 70 Interiver cmniuerce - Feb 1997 - Word Count: 239 - ABI/INFORM® 

□ 71 Ti ghter security loosens the constraints on electronic commerce - Feb 1997 - Word Count: 

2402 - ABI/INFORM® 

□ 72 Using quality to position EBT services, (electronic benefits transfer) - Feb - 1997 - Gale 

Group Trade and Industry Database™ 

LJ 73 Rrst3%ma^ 

JioMMflMJi iii:Mi'3 m\km^) - Feb 18 - 1997 - Gale Group Trade and Industry Database™ 

□ 74 Surfing the EFT wave - Apr 1997 - Word Count: 775 - ABI/INFORM® 

G 75 Treasury to test tech consortium's e-check system^ ( Treasn^y Depttrtment plans to use 

Internet^^^^ - April 25 - 1997 - Gale Group 

Trade and Industry Database™ 

□ 76 Visa. Mast ercard PuMshJSirr Protocol s - June 3 - 1997 - Word Count: 

655 - Gale Group PROMT® 

LJ 77 Vj$a, Ma^teroaM P^ - June 3 - 1997 - Gale Group Computer 



O 78 VjjiluafeMCur^. (dectroni^j>a:^yru^ 

secnrity) - July - 1997 - Gale Group Trade and Industry Database™ 

□ 79 BI^Mfj^s or lotg Mjtd - Aug 4, 1997 - Word Count: 1 196 - ABI/INFORM® 

□ 80 A s ur vey of ^^eifcc ted federa|^^^r^^ electronic f in an 

services - Nov 1997 - Word Count: 22168 - ABI/INFORM® 
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PROMT® 

Ll 82 WhAt'S m it for H^erclmnts?: seciire electroBic trm^sactloii protocol, needs a better 
business case to i^ain acceptance. - May 6 - 1998 - Gale Group Trade and Industry 
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□ 83 Dmital Cash Needs to Prove Its Viabiiitv. CIti Exec Savs> - June 9 - 1998 - Gale Group 

Trade and Industry Database™ 

□ 84 Internet biil presentment and payment: billers and banlvs empoweriBg each other. - 

Summer - 1998 - Gale Group Trade and Industry Database™ 

CJ 85 Statement^ to the C - Aug 1998 - Word Count: 3315 - 

ABI/INFORM® 

lJ 86 l)ii"hne i asHrance serves as coniMence-b uif der - Aug 1998 - Word Count: 785 - 
ABI/INFORM® 
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Payments on the 'Net? How many? How safe? 
Lunt, Penny 

ABA Banking Journal , v87nll , Page: 46-54 , Nov 1995 

Research firm Killen & Associates estimates that there will be 7 billion Internet payments made in the 
year 2000 and 17 billion in 2005. Assuming a typical transaction fee of $1.50, the organizations that 
dominate Internet commerce will take in $1 1 billion in 2000 and $26 billion in 2005. Both nonbanks and 
banks have a head start in the embryonic Internet retail payment system, which so far includes only credit 
card and off-line debit card payments. The first company to provide secure credit card transactions over 
the Internet, First Virtual Holdings, Inc., has been growing 15% a week since February, 1995. Banks 
need to form a policymaking entity that makes rules for Internet commerce. Michael Karlin of Security 
First Network Bank warns that the banking industry has given away profitable niches before, and it is 
possible that it could give this one away. 



If banks take on as strong a role in payments made on the Internet as they do in the traditional payments 
world, they can make a lot of money passing funds around and issuing credentials for consumers and 
merchants. On the other hand, if MCI, AT&T, or other companies decide banks are moving too slowly 
and that they Ve got to set up their own on line payment system, they*ll handle the profitable business and 
banks will end up just doing the back end processing, warns Michael Karlin, president and chief operating 
officer of Security First Net work Bank. If banks don't take the initiative, "money will get sucked out of 
that piece of the business," says Karlin. A subsidiary of Cardinal Bancshares, Lexington, Ky., Security 
Firsts one location, an Internet site, was scheduled to open Oct. 18. 

In 1994, $4.6 trillion worth of retail and wholesale purchases were made around the world, according to 
research firm Killen & Associates, Palo Alto, Calif, which recently produced a report on Internet 
commerce for MCI. About 13% of those purchases, $595 billion worth, were made remotely, by catalog, 
TV, electronic data interchange, and on-line networks including the Internet. All of these purchases will 
start gravitating toward the Internet during the next ten years. While actual Internet purchases were 
negligible last year, Killen projects that people and businesses will buy $600 billion in goods and services 
on the Internet in the year 2000 and $1.25 trillion in 2005. 

This is backed up by a survey consulting fimi Global Concepts Inc., Atlanta, conducted for Visa, 
MasterCard, and Verifone. While only 32% of Internet users said they currently shop on the Internet, 
90.7% said they plan to in the fiiture. 

Killen estimates there will be seven billion Internet payments made in 2000 and 17 billion in 2005. 
Assuming a typical transaction fee of $1 .50, the organizations that dominate Internet commerce will take 
in $1 1 billion in 2000 and $26 billion in 2005. (The costs will probably be 50% to 60% of that.) 

Both nonbanks and banks have a head start in the embryonic Internet retail payment system, which so far 
includes only credit card and off-line debit card payments. Such nonbank companies as First Virtual, 
CyberCash, Netscape, and Open Market are facilitating the card-based transactions. But banks' 
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' cardholder and merchant relationships are, so far, intact because the actual credit card clearing and 
settlement process is the same as it normally is. Except, that is, that the Internet provides new 
opportunities for hackers and others to steal credit card numbers and commit fraud. 

New types of payments are coming to the Internet: electronic checks, on-line debit, and electronic cash. 
The Global Concepts survey showed that Internet users want such options. Asked to rate on-line 
payment options one to five, the respondents ranked credit cards 3.66, digital cash 3.33, checking 
accounts 3.25, ATM cards 2.80, and prepaid cards 2.62. 

CREDIT CARDS 

Cybershoppers currently can only pay for Internet items with credit cards or with MasterCard and Visa 
debit cards. They can type their credit card number on the Internet and take the risk that another Internet 
user will see it. They can also use some type of security. 

The first company to provide secure credit card transactions over the Internet, First Virtual Holdings, 
Inc., San Diego, has been growing 15% a week since February and the company has signed up 750 
merchants. Its acquiring bank for now is First USA, although it wants to establish relationships with other 
banks. 

First Virtual holds card and payment information away from the Internet, so the consumer never passes a 
credit card number over the Internet, only a password. Consumers register credit card information with 
First Virtual by phone or e-mail, and it verifies this information and subsequent purchases by e-mail. The 
company is beginning to use digital signatures with its authorization messages. 

First Virtual acts as an intermediary between banks and their merchants. "Internet transactions are 
complicated and there are a lot of things that can happen in the course of Internet commerce where a 
technical failure is indistinguishable on the buyer's end from merchant fraud," says Chief Scientist 
Nathaniel Borenstein. "Who's supposed to resolve those things? An Internet intermediary is an alternative 
to chargebacks," 

Encrypted browsers 

Every other credit card transaction security system besides First Virtual's involves software that encrypts 
credit card information. An example is secure "browsers"— software programs that help people move 
around the World Wide Web. Netscape Communications, Mountain View, Calif, makes Navigator, the 
best-selling browser. The company also provides a Netscape Commerce Server that allows merchants to 
deliver documents to, and collect payments from, consumers over the Internet. First Union's merchants 
use this server, 

CyberCash, Reston, Va., also provides encryption software for credit card payments over the Internet. It 
has signed up 120 merchants (10 of which are actually accepting credit card payments over the Internet) 
and several banks to use its system, including Wells Fargo; First National Bank of Omaha; Boatmen's 
Credit Card Bank; Mellon Bank; National Bank of the Redwoods, Santa Rosa, Calif; U.S. Bank; and 
Compass Bank, Birmingham, Ala. 

CyberCash payment encryption can be used on top of Netscape Navigator or with other software 
provided by CyberCash and Checkfree, Columbus, Ohio, called an "electronic wallet." CyberCash says its 
encryption is stronger than Netscape's; while Netscape uses a 52-bit algorithm to encrypt U.S. payments, 
CyberCash uses a 768-bit algorithm. 
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Visa and MasterCard: cooperation? 

Visa and MasterCard have taken their battle for credit card brand supremacy to the Internet. The 
associations announced in June that they would jointly issue credit card transaction standards for the 
Internet that all software companies could use, which would enable banks and merchants to easily let 
their customers use both Visa and MasterCard cards on the Internet. 

Then in September Visa independently announced a set of standards with Microsoft called Secure 
Transaction Technology specifications. STT is a method of passing payment information around that uses 
public-key cryptography and digital signatures for security. 

Under STT, the consumer will send order information directly to the merchant and credit card 
information directly to the merchant's bank. "Keeping the payment information separate from the order 
provides stronger security for both aspects of the transaction," says Steve Herz, Visa's department head 
for electronic commerce. 

Microsoft has not published the source code for STT (a sore point with competitors) and plans to collect 
a small fee for every transaction. It is incorporating the STT standards in all fixture software applications 
related to Internet commerce. 

In October MasterCard, along with IBM, Netscape, GTE, and CyberCash announced a different set of 
technical requirements-the Secured Electronic Payment Protocol This uses a scheme similar to Visa's. 
MasterCard says the difference is that its protocol was developed in the open—working with industry 
standards groups, vendors, financial institutions, and others—was sent out for comment, and provides 
everything a software developer needs to create SEPP products. Netscape has published the source code 
for Secure Courier, its SEPP application. 

It remains to be seen if the two rivals will support a common standard. 
ELECTRONIC CHECKS 

"The check is the most popular form of noncash payment," points out John Doggett, director of applied 
technology at Bank of Boston. "Its volume exceeds that of credit, debit, point-of-sale, and ATM card 
transactions by three to four times. We'd like to bring the popularity of paper checks to the electronic 
world." 

Doggett heads up the electronic check project of the Financial Services Technology Consortium, an 
association of banks and technology companies. The group performed the first-ever electronic check 
transaction over the Internet on Sept. 21. 

He hopes the electronic check will be received as a welcome alternative to credit cards on the Internet, 
not only because people like writing checks, but also because electronic checks are more versatile-they 
let you send money to a child in college or pay a utility bill, for example. 

The consumer will need an electronic checkbook, which currently is a personal computer memory card— a 
card the size of a credit card but a little bit thicker that holds data and can be inserted in a slot at the back 
of most laptop computers. In the fiiture it will be a smart card, a card with a computer chip in it. The 
checkbook, which will be locked with a password, will generate checks, maintain a check register, and 
store public and private keys. 
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The small merchant will also need a PC card and the large merchant will need a special processor on its 
server. Messages passed between customer, merchant, and merchant bank will be secured with public-key 
cryptography and digital signatures. 

The check will then be wrapped in an ACH transaction and cleared through the automated clearing 
house. 

Although some of the lure of the Internet comes from users' ability to go places and do things 
immediately, customers have responded well to the idea of the one-day delay caused by ACH settlement. 
"A lot of people have called about this, and they always ask me, 'how long does it take the checks to 
clear?' We say between 24 and 36 hours. They say, 'that's an improvement over what I have and I don't 
want the money coming immediately out of my account anyway," says Doggett. "People still hang on to 
that float idea." 

Third-party companies and banks will likely issue electronic checkbooks. "You might buy a modem and a 
card as a packaging option from a modem manufacturer," Doggett suggests. If an outsider wants to pick 
up that cost, it's fine with him. 

A consultant at Killen & Associates believes bill payment companies like Checkfree will also develop 
electronic checks and that Telecheck, Equifax, and other check guarantee companies will start 
guaranteeing checks on the Internet. 

People could only initialize their cards (in other words, get public and private keys installed on them) at a 
bank or its trusted agent, Doggett says. "This is not a complicated task, but it has to be done in a very 
controlled environment," he says. 

The FSTC*s goal is to make the electronic check the lowest-cost form of payment available on the 
Internet. How will the electronic check compete against credit cards, debit cards, and cash payments on^ 
the Internet! "I don't see it as a winner-take-all case," says Doggett. "I see it as alternatives of choice." 
That's certainly the case in the existing world of payments. 

ELECTRONIC CASH 

Mondex has and Microsoft is developing smart-card-based electronic cash. In their schemes, consumers 
get a card onto which they can load money, in the form of electronic data, from a bank account. They can 
do this at a phone, an ATM, or a computer. They can then spend the money on the card on the Internet, 
at a store, at a phone, or at a vending machine. Several other companies, including CyberCash, DigiCash, 
and Citibank, are developing electronic systems that replace currency with electronic dollars, with or 
without a card. 

Citibank's Electronic Monetary System is still in the research and development phase, says spokeswoman 
Nina Das. "This is a pure technology that comprises issuing banks, correspondent banks, a plurality of 
transaction devices, teller devices, and security, reconciliation, and clearing processes," she says. "It will 
support network transactions." 

Citibank is creating proprietary hardware and software for the system. The hardware will be packaged in 
personal computers, hand-held devices, and cellular phones. A PC card will initially be used in the system, 

CyberCash will soon be able to message money from one checking account to another using the Internet 
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as the messaging medium and clearing the credits and debits through the ACH. "The money will never 
leave the banking network," says Magdelena Yesil. Payment requests will be encrypted with the same 
768-bit algorithm CyberCash uses for credit cards and sent to CyberCash and/or a bank, which will 
decrypt the message and honor the request- 

DigiCash, based in Amsterdam, is testing a system of anonymous cash payments over the Internet with 
4,000 individuals and 70 merchants. The consumer using DigiCash's e-cash software can withdraw 
electronic cash from a bank and store if on his computer*s hard drive in the form of encrypted "coins." 
The consumer can then spend that money at any Internet merchant accepting e-cash, or send e-cash to a 
friend or relative. DigiCash has created "blind signature" technology that lets a consumer send money to a 
recipient without the recipient being able to tell who it's from. 

Who can create money? 

ABA is not happy with some of these e-cash models. "We have a problem with companies like DigiCash 
where they're opening up what looks like an account for a customer, where they hold fiinds and then 
transmit them to a merchant," says Phillip S. Corwin, director and counsel of operations and retail 
banking. Only banks should be allowed to create money through fractional reserving or to create demand 
deposit accounts, he says. "Otherwise you have people establishing banking account relationships without 
banking regulation or FDIC protection." 

Mondex is OK with ABA, however, because its rule is that only banks can issue Mondex cards. 

The federal government also has concerns about e-cash and other payments on the Internet. "The 
changing technology could open up potential for money laundering, counterfeiting, credit card fraud, and 
other fraud," says Stanley Marris, director of the Treasury Department's Financial Crimes Enforcement 
Network. This department, called FinCEN, sponsored September meeting in New York of financial 
services providers, software developers, academics, consumer representatives, and government officials 
to discuss electronic payment systems and their impact on public policy. 

Another concern is that right now, the government has no way to collect taxes on Internet payments. And 
with payments moving across state and national borders, it's unclear whose taxes are due on each 
transaction. 

Banks need to take control 

As all these different schemes develop and become more structured, "The key question is: Who sirs at the 
very top of the hierarchy, who is at the root of the whole Internet payments system?" says Karlin at 
Security First. "Is it the Federal Reserve, is it Microsoft, is it the banking industry? We suggest it should 
be controlled by the banking industry." 

So far, merchants and consumers have had to sign up with a third party to get their transactions cleared. 

In the fiiture, all customers and merchants will go to their bank to get their on-line credentials, Karlin 
predicts. Banks will set up an Internet electronic payment system in which they settle with one another as 
they do in ACH and ATM switches. 

Meanwhile, banks need to form a policymaking entity that makes rules for Internet commerce, he 
believes. For example, to get public and private keys, a consumer might be required to go to the bank or 
third party in person, present three forms of ID, and sign a document to move dollar amounts up to 
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' $5,000. Rules should also be made about liability— and soon. 

"The banking industry has given away profitable niches before and it's possible it could give this one 
away," he says. "It would be hard for someone else to take this over, but the banking industry can*t sit 
around waiting for it to happen." 

IS THE INTERNET HOPELESSLY FLAWED? 

A fi*ont-page article in the Oct. 1 1 New York Times, "Discovery of Internet Flaws Is Setback for 
On-Line Trade," began with this sentence: 

"Newly publicized weaknesses in the basic structure of the Internet indicate that the worldwide computer 
network may need a time-consuming redesign before it can be safely used as a commercial medium." 

The article quoted an MIT professor who said the entire Internet has always been insecure and commerce 
on it won't be truly safe until it is rebuilt. 

Not everybody agrees with this view. "Most of the payment infi-astructure we need is aheady in place," 
says Bill Orr, editor of the monthly newsletter CyberBanking and a contributing editor to this magazine. 
The missing link is security for transactions moving over the Internet itself The design of that 
link— cryptography implemented primarily in software— is generally accepted and being field-tested. When 
the end-to-end system is ready for deployment, it will probably yield greater security than present 
payment systems." 

The Internet is no different fi*om other networks like America Online, CompuServe, Prodigy, and the 
Microsoft Network, says Michael McChesney, president of Five Paces Software, Inc., Atlanta. "If you 
use security technologies, you can make them secure, if you don't use them, none of them are secure," he 
says. Five Paces provides secure operating systems for banks that want to offer banking over the Internet. 

McChesney agrees that the NFS protocol developed by Sun Microsystems has security weaknesses, but 
adds, "I'm not aware of one company on the Intemet that makes use of NFS." He Says his company built 
a secure version of NFS and sold it to the government. 

Public-key cryptography, the most promising means of securing Intemet payments, can be compromised 
if a cyberthief steals someone's private key. But by the same token, a criminal could steal an account 
number or a credit card number and use it, a risk companies live with every day. 

McChesney believes the threat of Intemet payment fi*aud can be prevented with security controls and 
auditing on the database and operating system itself 

"Before I read one more expert telling me it's impossible to do anything on the Intemet," McChesney 
says, "I'd like to lose the very first dollar to fi*aud on the Intemet." 

NET JARGON DECRYPTED 

Browser— Software people use to move around the World Wide Web. 

Digital signature— A security measure that protects messages sent over the Intemet. A message is passed 
through a one-way cryptographic fiinction (that cannot be reversed) to produce a message digest. When 
the message digest is encrypted with the sender's private key and appended to the message, it becomes a 
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* digital signature. 

Internet— The largest collection of computer networks in the world. Originally used mainly by government 
and academia, it has 4,8 million computer hosts and 10,000 are added every day— many by commercial 
enterprises now. An estimated 40 million people are connected to it. A billion e-mail messages are sent 
over it every month. Electronic commerce on the World Wide Web portion of the Internet is just starting 
to gather steam. 

Private key— A mathematical key kept secret by the owner that is used to decrypt messages or files and 
^creMe'digitS^signatures . 

Public key— A mathematical key that belongs to one person or entity that is available publicly. Public keys 
are used to encrypt messages or files that can only be decrypted using a matching private key. They are 
also used to verify signatures that, were created with a matched private key. 

Public-key cryptography— A method of cryptography that depends o a matched pair of public and private 
^key?:~inftnTOarion encrypted with one key can only be decrypted with the other. 

World Wide Web— A method of retrieving information fi-om the Internet. Documents are linked by the 
use of an Intemet protocol, such as Universal Resource Locators, HyperText Transfer Protocol, or 
HyperText Markup Language, that lets people jump fi*om one document or web site to another. 

Copyright © American Bankers Association 1995 
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Should you feel secure? (online transactions on the Internet)(The Internet) 

Rasmussen, Jeremy 

Computer Dealer News , Volume: 12 , Number: 8 , Page: 35(1) , April 18 1996 

Historically, application products or environments have been accepted into companies at a judicious rate. 
This gradual uptake period has let many of the bugs and security issues be addressed at a non-critical 
rate. 

Today*s new application breed is Internet-enabled, forcing the issue of quality right from the beta release. 
The limited number of problems so far can be attributed to the software vendor's recognition of the 
importance of security and reliability. This has heightened the role of quality assurance in the application 
engineering and testing phases. Vendors are now actively seeking advice on, and scrutiny of, their designs 
and methodologies by subjecting their products to independent groups of experts at pre-beta stages. 

The most common point of security criticism has surrounded on-line Internet transactions - credit card 
transactions to .be specific. Flaws did exist in the first round of browser secure transmission protocols. 
This fixeled the debate on this technology's readiness for Internet electronic commerce, but these flaws 
should be evaluated on fact and not headline. 

Credit card fraud happens every day and accounts for losses in the millions for Canadian financial 
institutions. So why is it that the latest debit card scam does not get front page news? 

Consider the following: consumers feel no hesitancy in faxing or phoning their personal and credit card 
information to complete strangers at a mail order company; the resources (time, financial, and 
computational) needed to intercept your transaction outweigh the value of information potential abusers 
might hope to obtain; and collecting masses of credit card numbers electronically has little value to any 
criminal. 

For businesses using the Internet, fears of targeted attacks are more reahstic. Any company bouncing data 
across the Internet's communal servers is probably already employing two basic strategies: encrypt using 
a protocol you control; and be aware of the route most of your packets will be taking, preferencing 
reputable core networks and splitting the routes your packets take. 

Safe, secure Internet business transactions are a reality. They are carefixlly engineered using commercial 
tools, and are adding competitive advantage to the companies using them now. 

On-line credit card transactions are also a reality. The delay we have seen is mainly a result of banks 
being reluctant to set interim standards. Web server credit card transaction components will be available 
very shortly, and then vendors will just have to give us reasons to shop on-line. 

Jeremy Rasmussen is a principal at Inline Information Services, a Mississauga, Ont. -based Internet 
consulting firm. He can be reached by e-mail at JeremyR@interlog.com. 

Copyright © 1996 Plesman Publications Ltd. (Canada) 
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Industry players in hot pursuit of secure Internet transaction mode 

Day, Jacqueline 

Bank Systems & Technology , v32nl , Page: 6 , Jan 1995 

Demonstrating steady interest in this growing segment, 1994 ended with the alignment of industry 
suppliers and banks in several Internet-based electronic commerce deals. Security - the most pressing 
concern associated with putting financial transactions on a public data network - characterized each 
partnership, indicating that technology vendors, credit card processors, card associations and banks are 
apparently eager to get to work on the issue and move the financial industry a step closer to actual 
implementation. 



LAST YEAR ENDED WITH THE alignment of industry suppliers and banks in several Internet-based 
electronic comirrerce (EC) deals, demonstrating steady interest in this growing segment of the market. 
Security—the most pressing concern associated with putting financial transactions on a public data 
network—characterized each partnership, indicating that technology vendors, credit card processors, card 
associations and banks are apparently eager to get to work on the issue and move the financial industry a 
step closer to actual implementation. 

But the similarities end there. Although each deal is based on an effort to enter the growing Internet 
transaction market, the companies involved bring different strengths and objectives to their initiatives: 

* Microsoft Corp. and Visa International, via an exclusive partnership, plan to lay a new foundation for 
Internet commerce by combining the Redmond, WA, heavyweight's technological prowess with the San 
Francisco card association's market share. The specifications for the network security method that the 
companies plan to codevelop will be released to the rest of the industry-including, if it's interested, Visa 
archrival MasterCard Intemational. 

* First Data Corp.'s Electronic Funds Services (EFS) division and Mountain View, CA-based Netscape 
Communications Corp. will also share expertise. But their nonexclusive collaboration will rely on 
Netscape's new Netsite Commerce Server software— which provides an encrypted channel for online 
transactions— and EFS's credit card payment processing expertise. Their goal? Convince EFS bank clients 
to offer their merchants Internet-based transaction services, which will be processed by EFS, of Menlo 
Park, CA. Merchants, in turn, will establish Internet "storefi*onts" by buying the Netscape software. 

* In-market rivals Wells Fargo Bank and BankAmerica Corp. have separate plans to use competing 
Internet payment services. BofA will run Netscape's data encryption software; Wells will use a similar 
product fi*om CyberCash, Inc., a four-month-old Reston, VA-based start-up. Both banks will allow credit 
card data to be transmitted fi'om merchants with which they have existing relationships. 

It's three different flavors of Internet access, and with good reason— players are eager to differentiate 
themselves and put their own spin on secure Internet access in this competitive segment of the EC 
market. "Fortunately, there are a couple of different approaches," notes First Data svp Chuck White. 
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One thing that vendors do agree on: Move quickly. "Things are happening very fast in the marketplace," 
says Carol Coye Benson, svp of advanced payment strategies at Visa. "We certainly wanted to share with 
people where we stood so people knew what was coming." 

Indeed, the Microsoft- Visa alliance stands to have considerable impact on the market. The partnership's 
stated intention is to develop a new standard for secure Intemet-and other network-based transactions on 
both the cardholder and merchant sides. 

"This is an enabling technology," says Microsoft product manager for advanced technology Tom 
Johnston. "Is technology designed to let other things happen." 

The standard's initial release, due out this year, will be based on the Microsoft Windows operating system 
and work with Visa's VisaNet payment system. Other card networks and software vendors can work with 
the technology, with the goal that it later becomes an industrywide standard, says Benson. 

In contrast, Netscape and CyberCash represent proprietary, product-oriented steps to secure Internet 
commerce. 

Copyright © Gralla Publications 1995 
ABI/INFORM® 
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Smart card used to secure access for funds transfers. (Cash Management) 

Amette, Denise A. 

Corporate Cashflow Magazine , Volume: 15 , Number: 3 , Page: 6(3) , March 1994 

Smart card technology can greatly enhance security procedures for large-scale interbank and intrabank 
funds transfers. Chase Manhattan and IBM, for example, have developed one innovative application of 
this technology which can be used to prevent fraud in treasury operations. The system operates with the 
help of smart cards that have access control information embedded on microchips built into their 
magnetic strips. This type of security system requires only a peripheral device called a magnetic card 
reader, which is used to apply the checksum algorithm needed to clear a treasury transaction as authentic. 
There are other apphcations of smart card technology which could be developed once the technology 
grows out of its infancy. These applications include the use of smart cards to track the medical history of 
policyholders of life and health imsurance plans and to control the spread of fake drivers' licenses. 

The security of your corporate funds transfers may be in the cards—smart cards that is. Smart cards are 
plastic cards containing a microchip that can store as much as 6000 bytes of information. Several 
companies have been working on the technology, and IBM has now produced a multi-application card 
designed to provide encryption and authentication for high-dollar transactions. According to George 
Dolan, senior engineer at IBM in Charlotte, NC, IBM's smart card was conceived as an access control 
device that carries a profile of activities that the holder can and cannot do. "When used in conjunction 
with our cryptographic input/output unit, the smart card is quite effective at securing large-dollar 
transactions," he says. 

While several banks here and abroad have been using the smart card to protect interbank and intrabank 
funds transfers. Chase Manhattan appears to be the first to put it in the hands of treasury managers, 
working with IBM to develop a smart card security enhance merit for its Infocash treasury workstation. 
Providing adequate security for money transfer systems has been a constant battle for large companies. 
All sorts of techniques— log-ons, multi-level passwords and authentication and encryption—have been 
developed to enhance security and subdue corporate anxieties. 

Neverthless, fraud continues to make alarming headway. Smart cards may offer new hope. 

The chip embedded in the Chase-IBM smart card can authenticate and encrypt information for 
work-station-initiated funds transfers. Under normal encryption and authentication routines, standard 
software would read the dollar amount, name of payee and bank account number, and compute a 
"checksum"— a series of numbers derived by applying an algorithm to the transaction data. This checksum 
would become the message authentication code that would be entered into the funds transfer initiation 
software and sent to the bank. 

The bank, in turn, would use the same algorithm to compute a checksum based on the transmitted 
transaction data. If the bank's checksum did not match the authentication code, the transfer request would 
be rejected. 

While this process seems secure, it is possible for someone to copy the authentication software and 
produce his or her own valid checksums. It is this risk that the smart card attempts to minimize. 
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The process requires a special magnetic card reader, a $1,200 peripheral device that is attached to the 
workstation. The checksum algorithm is placed on a computer chip and embedded into the plastic card's 
magnetic strip. 

When an authorized user wants to make a funds transfer, he or she enters the transaction information and 
runs the card through the reader. The reader, in turn, applies the checksum algorithm on the card to the 
transaction information to automatically calculate and enter the checksum. 

Chase, like a number of other banks, tested the technology internally before introducing the device to 
customers: 

Gene Rao, vice president of transaction security at Chase, admits the smart card is not for every 
company. "Most customers now using the technology are intemational in scope and Fortune 50 in size." 
They are also likely to do a lot with electronic data interchange (EDI). 

But Craig Goldman, senior vice president of technology for Chase, sees the technology edging toward a 
much broader use within corporations. "Not only will these cards improve system security by further 
restricting access to sensitive systems," he says, adding "they will provide a new alternative for physical 
security for employees entering business facilities, and they will eliminate the need for money to be used 
on site." 

This latter use is known as an "electronic purse." An employee would buy a block of purchasing power, 
stored in the microchip. Each purchase would reduce the credit balance. 

Bob High, an IBM contract engineer who has worked on this project, sees smart card appHcations 
spanning several industries. Health maintenance organizations', hospitals or insurance companies could 
issue smart cards to members and policy holders. 

"The cards could hold a person's entire medical history, including illnesses, medications, billings and 
insurance coverage," he says. New diagnoses, medication or billing transactions could be added. 

States are using smart cards to combat forged drivers' Hcenses, Mr. High reports. 

The technology is still in its infancy, but new applications for industries as varied as insurance, 
transportation and retail point-of-sale are being explored. 
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IRE ANNOUNCES NEW LOW COST PRODUCTS TO SECURE ELECTRONIC FUNDS 
TRANSFERS 

PR Newswire , Page: 0628DC011 , June 28 1993 

BALTIMORE, June 28 /PRNewswire/ -- Information Resource Engineering, Inc. (NASDAQ-NMS: 
IREG) today announced an inexpensive line of products which employ multiple forms of encryption 
technology to reduce risks in electronic funds transfers (EFT). Prior to the development of these 
products, EFT security has been expensive and complex due to the unique needs of each bank's electronic 
services. IRE*s new products, the AX500, AX200 AND AXlOO, allows banks and their clients a choice 
of encryption, message authentication and user authentication to secure funds transfers at prices 
heretofore unavailable. 

IRE's Chairman Anthony Caputo noted: "Corporate clients have varying needs for EFT security. Large 
corporations require multiple security technologies while smaller corporations can guarantee data 
integrity with less stringent security. Therefore, financial institutions and their corporate customers, both 
large and small, can choose from a menu of IRE's certifiably secure products that are commercially 
reasonable and competitively priced." 

AX500 - High Level Security for High Risk AppHcations 

The AX500 uses Encryption Technology to provide three forms of data security: Data Encryption, 
Message Authentication and User Authentication. To maintain rigorous security, the AX500 
automatically manages different encryption keys for each bank with which the corporate client 
communicates thus reducing cost by sharing the AX500 with multiple banks. 

AXlOO and AX200 - Simplicity and Low Cost 

The AX200 uses Data Encryption to provide medium level security for clients with moderate transaction 
or dollar volume. Priced at $295, the AX200 is both inexpensive and easy to use, and is ideal for cHents 
who require this level of security. 

The AXlOO, priced even lower at $250, uses Encryption Technology to identify and authenticate remote 
users so that only authorized users may access the host computer. The PC user simply inserts an IRE I.D. 
Card, a credit card containing an embedded encryption chip, into the AXlOO. Authentication is fully 
automatic, fast and secure since it is based on encryption technology. 

Company Background 

Information Resource Engineering, Inc., provides technologically advanced, cost-eflFicient Network 
Security Systems. IRE products use the Data Encryption Standard (DES), the preferred encryption 
algorithm for financial institutions internationally. IRE's clients include Citibank, J. P. Morgan, the U.S. 
Department of the Treasury, the U.S. Internal Revenue Service and AT&T Communications. 
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/NOTE: I.D. Card is a trademark./ 

/PRNewswire — Roberta Bowersox of Information Resource Engineering, 410-931-7500/ 
(IREG) 

CO: Information Resource Engineering ST: Maryland IN: CPR SU: 
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